Dahuasecurity vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-45431 Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server.High 7.5 · Dec 27, 2022
• CVE-2022-45429 Some Dahua software products have a vulnerability of server-side request forgery (SSRF).High 7.5 · Dec 27, 2022
• CVE-2022-45427 Some Dahua software products have a vulnerability of unrestricted upload of file.High 7.2 · Dec 27, 2022
• CVE-2022-45425 Some Dahua software products have a vulnerability of using of hard-coded cryptographic key.High 7.5 · Dec 27, 2022
• CVE-2022-45423 Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials.High 7.5 · Dec 27, 2022
• CVE-2022-30563 When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying thHigh 7.4 · Jun 28, 2022
• CVE-2022-30560 When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet toHigh 7.4 · Jun 28, 2022
• CVE-2021-33046 Some Dahua products have access control vulnerability in the password reset process.Critical 9.8 · Jan 13, 2022
• CVE-2020-9502 Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities.Critical 9.8 · May 13, 2020
• CVE-2019-9682 Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal login of early devicHigh 8.1 · May 13, 2020
• CVE-2020-9499 Some Dahua products have buffer overflow vulnerabilities.High 7.2 · Apr 9, 2020
• CVE-2019-9676 Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11.High 7.8 · Jun 12, 2019
• CVE-2017-7927 A Use of Password Hash Instead of Password for Authentication issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2High 7.3 · May 5, 2017
• CVE-2017-7925 A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HCritical 9.8 · May 5, 2017
• CVE-2017-7253 Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1.High 8.8 · Mar 30, 2017
• CVE-2017-6432 An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices.High 8.1 · Mar 9, 2017
• CVE-2017-6343 The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS SoftwarHigh 8.1 · Feb 27, 2017
• CVE-2017-6342 An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS SCritical 9.8 · Feb 27, 2017
• CVE-2013-6117 Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change useHigh 7.5 · Jul 11, 2014
• CVE-2013-5754 The authorization implementation on Dahua DVR appliances accepts a hash string representing the current date for the role of a master password, which makes it eHigh 10 · Sep 17, 2013
• CVE-2013-3615 Dahua DVR appliances use a password-hash algorithm with a short hash length, which makes it easier for context-dependent attackers to discover cleartext passworHigh 7.8 · Sep 17, 2013
• CVE-2013-3613 Dahua DVR appliances do not properly restrict UPnP requests, which makes it easier for remote attackers to obtain access via vectors involving a replay attack aHigh 7.8 · Sep 17, 2013
• CVE-2013-3614 Dahua DVR appliances have a small value for the maximum password length, which makes it easier for remote attackers to obtain access via a brute-force attack.High 9.3 · Sep 17, 2013
• CVE-2013-3612 Dahua DVR appliances have a hardcoded password for (1) the root account and (2) an unspecified "backdoor" account, which makes it easier for remote attackers toHigh 10 · Sep 17, 2013